Cybercriminals Escalate Threats with Physical Violence in Extortion Schemes
Cyberattacks are increasingly accompanied by threats of physical harm, marking a dangerous evolution in ransomware and extortion tactics. According to FBI data, incidents involving physical threats in the U.S. more than doubled last year, with similar trends reported in Europe, where over 18 cases were documented.
Attackers are leveraging stolen personal data such as home addresses, social security numbers, and workplace details to intimidate victims. In one instance, hospital staff received harassing calls from hackers who named nurses individually and disclosed their private information, creating a climate of fear. Some criminals go further, hiring third parties to carry out threats or even commit violence, a tactic known as "violence-as-a-service."
The cryptocurrency sector has become a hotspot for such attacks, with hackers targeting high-profile investors who flaunt their wealth online. Last year, French police rescued the father of a cryptocurrency millionaire who had been kidnapped, while another victim reportedly had a finger severed as part of an extortion attempt. Many perpetrators are young, with FBI profiles indicating ages between 17 and 25.
Ransomware gangs, some state-sponsored by nations like Russia, China, Iran, and North Korea, are driving this shift. A Semperis report found that in 40% of global ransomware attacks in 2025, criminals resorted to physical threats. The financial toll is staggering U.S. organizations lost $20.8 billion to cybercrime last year, up from $16.6 billion in 2024.
Experts warn the trend will persist as long as victims continue to pay ransoms. In one case, a cybersecurity negotiator received a threatening package at his home, underscoring the personal risks faced by those involved in ransom negotiations. The rise of "In Real Life Com," a network of online-linked criminals, has further normalized the use of real-world violence in cyber extortion schemes.
Source: https://www.bbc.com/news/articles/cr71d8vyjv0o
Federal Bureau of Investigation (FBI) cybersecurity rating report: https://www.rankiteo.com/company/fbi
"id": "FBI1778466322",
"linkid": "fbi",
"type": "Cyber Attack",
"date": "5/2025",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"{'affected_entities': [{'industry': ['healthcare',
'finance (cryptocurrency)',
'cybersecurity'],
'location': ['U.S.', 'Europe'],
'type': ['hospital',
'cryptocurrency investor',
'cybersecurity negotiator']}],
'attack_vector': ['stolen personal data',
'social engineering',
'violence-as-a-service'],
'data_breach': {'data_exfiltration': 'yes',
'personally_identifiable_information': 'yes',
'sensitivity_of_data': 'high',
'type_of_data_compromised': ['personal identifiable '
'information',
'workplace details',
'home addresses']},
'description': 'Cyberattacks are increasingly accompanied by threats of '
'physical harm, marking a dangerous evolution in ransomware '
'and extortion tactics. Attackers leverage stolen personal '
'data to intimidate victims, including hospital staff and '
'cryptocurrency investors, with some incidents involving '
'kidnapping and violence. Ransomware gangs, some '
'state-sponsored, are driving this shift, with physical '
'threats reported in 40% of global ransomware attacks in 2025. '
'The financial toll on U.S. organizations reached $20.8 '
'billion in 2025.',
'impact': {'data_compromised': ['home addresses',
'social security numbers',
'workplace details',
'personal identifiable information'],
'financial_loss': '$20.8 billion (U.S. organizations in 2025)',
'identity_theft_risk': 'high',
'operational_impact': ['climate of fear in hospitals',
'disruption of cryptocurrency operations']},
'initial_access_broker': {'high_value_targets': ['cryptocurrency investors',
'hospital staff']},
'lessons_learned': 'The trend of physical threats in cyber extortion will '
'persist as long as victims continue to pay ransoms. '
'Personal risks extend to cybersecurity negotiators and '
'other stakeholders.',
'motivation': ['financial gain', 'intimidation', 'data extortion'],
'post_incident_analysis': {'root_causes': ['stolen personal data',
'lack of ransom payment deterrence',
'normalization of violence in '
'cyber extortion']},
'ransomware': {'data_exfiltration': 'yes'},
'recommendations': ['Avoid paying ransoms to deter further attacks',
'Enhance protection of personal data to prevent '
'intimidation',
'Collaborate with law enforcement to combat '
'violence-as-a-service'],
'references': [{'source': 'FBI data'}, {'source': 'Semperis report (2025)'}],
'response': {'law_enforcement_notified': ['FBI'],
'third_party_assistance': ['French police (kidnapping rescue)']},
'threat_actor': ['ransomware gangs',
'state-sponsored actors (Russia, China, Iran, North Korea)',
'In Real Life Com network',
'young cybercriminals (ages 17-25)'],
'title': 'Cybercriminals Escalate Threats with Physical Violence in Extortion '
'Schemes',
'type': ['ransomware', 'extortion', 'physical threats']}